allow origin isn't sufficient to resolve CORS issue

Description

Adding allow origin and allow headers at template.yaml and returning Access-Control-Allow-Origin in the lambda response body seems insufficient to resolve cross origin issue after deploying the lambda service.

Steps to reproduce

sample of template.yaml

Globals:
  Function:
    Timeout: 60
  Api:
    Cors:
      AllowMethods: "'POST,OPTIONS'"
      AllowHeaders: "'*'"
      AllowOrigin: "'*'"
      AllowCredentials: "'*'"

Resources:
  EndpointFunction:
    Type: AWS::Serverless::Function
      CodeUri: api/v1/
      Handler: endpoint.lambda_handler
      Runtime: ruby2.5
      Events:
        Endpoint:
          Type: Api
          Properties:
            Path: /api/v1/endpoint
            Method: post

sample of endpoint.rb

def lambda_handler(event:, context:)
  {
    statusCode: 201,
    headers: {
      'Access-Control-Allow-Origin' => '*',
      'Content-Type' => 'application/json'
    }
  }
end

Observed result

Access to XMLHttpRequest at 'https://<random-sha>.execute-api.<aws-region>amazonaws.com/prod/api/v1/endpoint' from origin 'https://<domain>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Update: This turned out to be a url of lambda service is being case sensitive. Aside from that, there is currently no way to set multiple domains for allow origin. Also, the hassle way of defining an option function doesn’t seem to work either at least local #1434

Expected result

able to make request from the browser

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. sam --version: 0.22.0

[han-so1omon]

@kimyu92 were you able to make requests from the browser? if possible could you point me to your code so that I may study it? I’m having Cross-Origin Request Blocked: ... CORS header ‘Access-Control-Allow-Origin’ missing for a simple POST request

[jfuss]

@kimyu92

in the lambda response body seems insufficient to resolve cross origin issue after deploying the lambda service.

Are you seeing CORS issues with the Lambda Service or locally with SAM CLI? It sounds like this is an issue you are having with the Service.

Aside from that, there is currently no way to set multiple domains for allow origin.

This is a limitation of API Gateway: https://stackoverflow.com/a/39628785

Also, the hassle way of defining an option function doesn’t seem to work either at least local #1434

We have a open PR addressing this issue: https://github.com/awslabs/aws-sam-cli/pull/1464